#!/bin/bash
bin/zookeeper-server-start.sh config/zookeeper.properties &
base_dir="/root/kafka_2.12-2.1.0"  # kafka bin文件目录
ca_dir="/usr/ca"  # 证书生成的目录
if [ ! -d $ca_dir ]; then
	mkdir -p $ca_dir
fi
cd $ca_dir
rm -rf *
echo "setup1. 生成秘钥与证书"
# =============生成ssl秘钥与证书，设置密码为:caserver================================
# setup1
keytool -keystore server.keystore.jks -alias localhost -validity 365 -genkey -keypass caserver -keyalg RSA -dname "CN=caserver,OU=topsec,O=topsec,L=beijing,S=beijing,C=cn" -storepass caserver -ext SAN=DNS:localhost
# setup2
openssl req -new -x509 -keyout ca-key -out ca-cert -days 365 -passout pass:caserver -subj "/C=cn/ST=beijing/L=beijing/O=topsec/OU=topsec/CN=caserver"
keytool -keystore client.truststore.jks -alias CARoot -import -file ca-cert -storepass caserver
keytool -keystore server.truststore.jks -alias CARoot -import -file ca-cert -storepass caserver
# setup3
keytool -keystore server.keystore.jks -alias localhost -certreq -file server.cert-file -storepass caserver
openssl x509 -req -CA ca-cert -CAkey ca-key -in server.cert-file -out server.cert-signed -days 365 -CAcreateserial -passin pass:caserver
keytool -keystore server.keystore.jks -alias CARoot -import -file ca-cert -storepass caserver
keytool -keystore server.keystore.jks -alias localhost -import -file server.cert-signed -storepass caserver
#=============配置server.properties====================================
echo "setup2. 配置server.properties"
cat << EOF > $base_dir/config/server.properties
broker.id=0
listeners=PLAINTEXT://:9092,SASL_SSL://:19092
num.network.threads=3
num.io.threads=8
socket.send.buffer.bytes=102400
socket.receive.buffer.bytes=102400
socket.request.max.bytes=104857600
log.dirs=/var/log/zookeeper/kafka-log  # 日志路径
num.partitions=1
num.recovery.threads.per.data.dir=1
offsets.topic.replication.factor=1
transaction.state.log.replication.factor=1
transaction.state.log.min.isr=1
log.retention.hours=168
log.segment.bytes=1073741824
log.retention.check.interval.ms=300000
zookeeper.connect=localhost:2181
zookeeper.connection.timeout.ms=6000
group.initial.rebalance.delay.ms=0
#==========================  SASL CONFIG  ==========================#
sasl.enabled.mechanisms=SCRAM-SHA-512
sasl.mechanism.inter.broker.protocol=SCRAM-SHA-512
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
super.users=User:admin
#===========================  SSL CINFIG ============================
ssl.keystore.location=$ca_dir/server.keystore.jks
ssl.keystore.password=caserver
ssl.key.password=caserver
ssl.truststore.location=$ca_dir/server.truststore.jks
ssl.truststore.password=caserver
ssl.client.auth=required
ssl.enabled.protocols=TLSv1.2,TLSv1.1,TLSv1
ssl.keystore.type=JKS
ssl.truststore.type=JKS
ssl.endpoint.identification.algorithm=
security.inter.broker.protocol=SASL_SSL
EOF
#====================== 设置sasl凭证===================================
echo "setup3. 设置sasl凭证"
cd $base_dir
bin/kafka-configs.sh --zookeeper localhost:2181 --alter --add-config 'SCRAM-SHA-256=[iterations=8192,password=shenxinfu],SCRAM-SHA-512=[password=shenxinfu]' --entity-type users --entity-name shenxinfu
bin/kafka-configs.sh --zookeeper localhost:2181 --alter --add-config 'SCRAM-SHA-256=[password=admin-secret],SCRAM-SHA-512=[password=admin-secret]' --entity-type users --entity-name admin
#======================在config目录中添加jass文件=======================
echo "setup4. 在config目录中添加jass文件"
cat << EOF > $base_dir/config/kafka_server_sasl_jaas.conf
KafkaServer { 
        org.apache.kafka.common.security.scram.ScramLoginModule required 
        username="admin" 
        password="admin-secret"
        user_admin="admin-secret"
        user_shenxinfu="shenxinfu"
    };
EOF
#==================将jass配置文件位置作为jvm参数传递给每个Kafka代理=============
echo "setup5. 将jass配置文件位置作为jvm参数传递给每个Kafka代理"
sed -i s/exec.*/exec $base_dir\/kafka-run-class.sh $EXTRA_ARGS -Djava.security.auth.login.config=$base_dir/config/kafka_server_sasl_jaas.conf kafka.Kafka "$@"g $base_dir/bin/kafka-server-start.sh
#==================重启zookeeper和kafka=======================================
echo "setup6. 重启zookeeper和kafka"
cd  $base_dir
bin/zookeeper-server-stop.sh config/zookeeper.properties
bin/kafka-server-stop.sh config/server.properties
bin/zookeeper-server-start.sh config/zookeeper.properties
bin/kafka-server-start.sh config/server.properties



